---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/ ---------------------------------------------------------------------- TITLE: Firefox Greasemonkey Extension Disclosure of Sensitive Information SECUNIA ADVISORY ID: SA16128 VERIFY ADVISORY: http://secunia.com/advisories/16128/ CRITICAL: Moderately critical IMPACT: Exposure of system information, Exposure of sensitive information WHERE: >From remote SOFTWARE: Greasemonkey 0.x (extension for Firefox) http://secunia.com/product/5420/ DESCRIPTION: Mark Pilgrim has reported a vulnerability in the Greasemonkey extension for Firefox, which can be exploited by malicious people to disclose various information. The vulnerability is caused due to certain functions being insecurely exposed and can be exploited by a malicious web site via the "GM_xmlhttpRequest()" function to disclose the contents of arbitrary local files and list the contents of arbitrary local directories. Successful exploitation requires that a Greasemonkey script is configured to run on the malicious web site. The vulnerability has been reported in versions prior to 0.3.5. SOLUTION: The vulnerability has been fixed in version 0.3.5 by reducing the functionality. PROVIDED AND/OR DISCOVERED BY: Mark Pilgrim ORIGINAL ADVISORY: http://greaseblog.blogspot.com/2005/07/mandatory-greasemonkey-update.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------